ipsec site to site not established back NAT

RouterOS General
1

i have two Mikrotik (1,2) and want to Configure IPSEc between Mikrotik
i (pc0) connect to Mikrotik 1 with VPN sstp (IP Mikrotiik 1.1.1.1) and get Remote IP (192.168.10.10) and i want can connect to pc1
and i configure Tunnel IPSec with config below

Mikrotik 1:
/ip ipsec peer add address=2.2.2.2/32:500 auth-method=pre-shared-key secret=“test” nat-traversal=yes

/ip ipsec policy add src-address=192.168.1.0/24:any
dst-address=192.168.2.0/24:any sa-src-address=1.1.1.1
sa-dst-address=2.2.2.2 tunnel=yes ipsec-protocols=ah action=encrypt proposal=default

Mikrotik 2:
/ip ipsec peer add address=1.1.1.1/32:500 auth-method=pre-shared-key secret=“test” nat-traversal=yes

/ip ipsec policy add src-address=192.168.2.0/24:any
dst-address=192.168.1.0/24:any sa-src-address=192.168.2.10
sa-dst-address=2.2.2.2 tunnel=yes ipsec-protocols=ah action=encrypt proposal=defaul

but in mikrotik 1 tunnel is not up and state initiator
and in mikrotik 2 in menu remote peer something not shown.

2

Firewall rules?